Description
Frappe ERPNext 15.57.5 版本中，erpnext/accounts/doctype/loyalty_program/loyalty_program.py 文件内的 get_loyalty_program_details_with_points() 函数存在 SQL 注入漏洞，该函数在处理 expiry_date 参数时未进行充分的过滤和参数化绑定，攻击者可通过构造恶意 SQL 语句注入数据库查询，从而获取数据库中的全部敏感信息。
ERPNext /api/method/erpnext.accounts.doctype.loyalty_program.loyalty_program.get_loyalty_program_details_with_points SQL 注入漏洞（CVE-2025-52050）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-52050
https://github.com/advisories/GHSA-9jr7-wh3w-2599
https://access.redhat.com/security/cve/cve-2025-52050
https://devhub.checkmarx.com/cve-details/cve-2025-52050/
https://radar.offseq.com/threat/cve-2025-52050-na-8c9f0e81
https://www.thehackerwire.com/vulnerability/CVE-2025-52050/